IBM i EUVD-2026-36250

Exploitation requires an authenticated IBM i user profile (PR:L) with network access to the partition (for example through Telnet/5250, SSH, or Host Servers) and the ability to create program/service-program objects in at least one library that appears in the target job's library list ahead of the legitimate library - typically any library where the user holds *ADD or *CHANGE authority, or a personal library auto-added to *LIBL. No user interaction is required (UI:N) and no special non-default configuration is named in the advisory, but exploitation is limited to environments running IBM i 7.3, 7.4, 7.5, or 7.6 where the unpatched vulnerable component is invoked; partitions that strictly enforce qualified calls or that deny non-admin users object-creation rights in *LIBL libraries materially reduce exposure.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) describes a network-reachable, low-complexity attack requiring only low-privileged authentication and no user interaction, yielding full CIA impact - consistent with privilege escalation to *ALLOBJ/administrator on the host. There is no EPSS score, SSVC decision, or KEV listing supplied, and no public PoC is referenced, so real-world exploitation pressure today appears low; however, IBM i systems typically host high-value ERP and financial workloads, so any authenticated user-to-admin path is a meaningful priority for organizations running these releases. One conflicting signal worth flagging: the input tags include 'Information Disclosure,' but the description and CVSS impact metrics describe full code execution with administrator privilege - defenders should treat this as a privilege-escalation/RCE-equivalent issue rather than a pure disclosure bug.

A low-privileged IBM i user with network sign-on (for example via 5250 Telnet, SSH, or an ODBC/JDBC connection through the Host Servers) creates a program or service program whose name matches the unqualified call made by a trusted IBM i component and places it in a library that appears earlier in the library list than the legitimate one. When the trusted component is invoked - either by the attacker or in the normal course of operations - it resolves to the malicious object and runs the attacker's code under the adopted administrator authority, granting full *ALLOBJ-equivalent control of the partition. No public exploit identified at time of analysis.